booqable 2.0.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ee065493e3d48d59edfb13552c3dd8dbce2d800ecfb9d3c8230f6f3c52345be0
-  data.tar.gz: a9fd9934fd93f8504ca1a58e2cab82e09ab1f4f9f2da9fb4a30033e3f84bfe16
+  metadata.gz: ea7652c0e4f9625ad965a20a0d9ec5aaf6265cbaf7b464c958b393d1d11da6e5
+  data.tar.gz: 95f3928c775d8c74bf1a89f86de03b46bd05df79a0d6e4371049936b69306081
 SHA512:
-  metadata.gz: 4babbce96eead5118e72cf700490aa703fb221730a7bd601f23d229cad34f63c91b59f6a7d955e733b0ce111359eb1c8f4b5e54e3834647952c44baf6e222422
-  data.tar.gz: fe5bd8c6bc0150c6a61f45e72de5edfc35ae33335d7bc2fa514a31650a20e44ccbd4dfa8fe3df5a9d7bf22915148c4e0bc7a259c9620e316220b66f36990db7d
+  metadata.gz: 99cef1b7b21ae72fa8df8516ad6791b2e2568cca68463270d8e620b71a36b333f321cd5850a637c8fd22d384321887c1ac27afd26929b571f989620d025501f2
+  data.tar.gz: 021b52cd5054f2033c83a6234dce59f64fb9a30cf8884ee7ded7d35bb48e865b9467c33c84329ca006a407ab36716ff3bcee95f116a668821ccb9c7411a94a45

data/CHANGELOG.md

@@ -1,3 +1,26 @@
+## [2.2.0] - 2026-11-03
+
+- OAuth middleware: refresh the access token a short buffer
+  (`REFRESH_BUFFER_SECONDS`, 60s) before it expires, instead of only once it
+  has already expired. This fixes `Token is invalid` failures for requests
+  landing right at the token's expiry boundary, where network latency or clock
+  skew pushes an otherwise-valid token past expiry server-side.
+- Fix: a token refresh failing without an HTTP response (e.g. the stored token
+  has no refresh token) now raises the original `OAuth2::Error` instead of
+  crashing with `NoMethodError` while trying to map a response that isn't
+  there.
+- Require `multi_json` >= 1.21.2, the first release compatible with the
+  `json` 3.x gem. Older versions raise `ArgumentError` on every parse under
+  json 3.
+
+## [2.1.0] - 2026-07-16
+
+- Add the `app_issues` resource (CRUD for `App::Issue`).
+- Fix: a to-one relationship serialized with `"data": null` (e.g. a charge
+  line's `item`, or an included `barcode` on a product without one) now reads
+  as nil, matching the present-with-null attribute semantics — instead of the
+  parser dropping the key and the read raising `Booqable::MissingAttribute`.
+
 ## [2.0.0] - 2026-07-14
 
 - **Breaking:** reading an attribute that is absent from an API payload now

data/lib/booqable/json_api_serializer.rb

@@ -184,6 +184,11 @@ module Booqable
         # Handle multiple relationships (to-many)
         elsif relationship_data.is_a?(Array)
           hash[key] = relationship_data
+        # An explicitly null to-one relationship ("data": null) is present-with-null, not
+        # absent: keep the key so strict reads answer nil instead of raising
+        # Booqable::MissingAttribute (see Booqable::StrictAttributes).
+        elsif relationship_data.nil?
+          hash[key] = nil
         end
       end
 

data/lib/booqable/middleware/auth/oauth.rb

@@ -15,6 +15,12 @@ module Booqable
       #     read_token: -> { stored_token },
       #     write_token: ->(token) { store_token(token) }
       class OAuth < Base
+        # Refresh the token this many seconds before it actually expires. A
+        # request sent in the last moment of a token's life can still be
+        # rejected once network latency or clock skew pushes it past the
+        # expiry boundary server-side.
+        REFRESH_BUFFER_SECONDS = 60
+
         # Initialize the OAuth authentication middleware
         #
         # @param app [#call] The next middleware in the Faraday stack
@@ -48,9 +54,9 @@ module Booqable
 
         # Process the HTTP request and add OAuth authentication
         #
-        # Retrieves the stored access token, refreshes it if expired, and adds
-        # it to the Authorization header. Then passes the request to the next
-        # middleware in the stack.
+        # Retrieves the stored access token, refreshes it if it is expired or
+        # about to expire, and adds it to the Authorization header. Then
+        # passes the request to the next middleware in the stack.
         #
         # @param env [Faraday::Env] The request environment
         # @return [Faraday::Response] The response from the next middleware
@@ -58,7 +64,7 @@ module Booqable
           around_refresh_token do
             @token = @client.get_access_token_from_hash(@read_token.call)
 
-            if @token.expired? || @token.expires_at.nil?
+            if expires_soon?(@token)
               @token = refresh_token!
             end
           end
@@ -70,6 +76,14 @@ module Booqable
 
         private
 
+        # Whether the token expires within the buffer, or has no usable
+        # expiry. expires_at may be an Integer epoch (OAuth2) or a Time
+        # (e.g. an ActiveRecord datetime handed back by read_token), so
+        # coerce it.
+        def expires_soon?(token)
+          token.expires_at.nil? || Time.now.to_i >= token.expires_at.to_i - REFRESH_BUFFER_SECONDS
+        end
+
         # Yield to the configured around-callback, if any
         #
         # When a host application provides one (e.g. an advisory lock), the
@@ -84,10 +98,16 @@ module Booqable
         #
         # Uses the refresh token to obtain a new access token and stores it
         # using the configured write_token proc. Converts OAuth2 errors to
-        # Booqable errors for consistent error handling.
+        # Booqable errors for consistent error handling. The OAuth2 error
+        # propagates as-is when there is no HTTP response to map (e.g. the
+        # stored token has no refresh token, so the error carries a plain
+        # Hash) or when the response maps to no Booqable error class (e.g. a
+        # 200 from the token endpoint without an access token — only 4xx/5xx
+        # map). A refresh failure must never return: the caller would carry
+        # on with a nil token.
         #
         # @return [OAuth2::AccessToken] The new access token
-        # @raise [Booqable::Error] For OAuth-related errors
+        # @raise [Booqable::Error, OAuth2::Error] When the refresh fails
         def refresh_token!
           new_token = @token.refresh!
 
@@ -95,9 +115,11 @@ module Booqable
 
           new_token
         rescue OAuth2::Error => e
-          response = e.response.response.env
+          http_response = e.response.response if e.response.respond_to?(:response)
+          raise unless http_response&.env
 
-          Booqable::Error.from_response(response)
+          Booqable::Error.from_response(http_response.env)
+          raise
         end
       end
     end

data/lib/booqable/resources.json

@@ -2,6 +2,7 @@
   { "app_carriers": "carriers" },
   { "app_subscriptions": "subscriptions" },
   { "app_payment_options": "payment_options" },
+  { "app_issues": "issues" },
   "authentication_methods",
   "barcodes",
   "bundles",

data/lib/booqable/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Booqable
-  VERSION = "2.0.0"
+  VERSION = "2.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: booqable
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.2.0
 platform: ruby
 authors:
 - Hrvoje Šimić
@@ -58,6 +58,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.15'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.21.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -65,6 +68,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.15'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.21.2
 - !ruby/object:Gem::Dependency
   name: addressable
   requirement: !ruby/object:Gem::Requirement
@@ -187,7 +193,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Official Booqable API client for Ruby.
 test_files: []